CVE-2026-54457: TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prio

Executive brief

TensorZero Gateway, a platform for managing AI model deployments, contains a vulnerability in its internal storage management component. An attacker can exploit this to read sensitive files from the server's local storage or force the system to make unauthorized requests to internal network services. This could lead to the theft of credentials or exposure of private data from cloud environments.

Technical details

The `/internal/object_storage` endpoint in TensorZero Gateway accepts a user-supplied JSON `storage_path` parameter that can dynamically override the `[object_storage]` configuration. By specifying a `filesystem` storage type, an attacker can perform an arbitrary file read to retrieve sensitive system files or credentials. Alternatively, by using the `s3_compatible` storage type, an attacker can perform Server-Side Request Forgery (SSRF) to target internal endpoints or cloud metadata services (e.g., IMDS). The vulnerability is exploitable by any network-reachable user if authentication is disabled, or by authenticated users if authentication is enabled. The issue is patched in version 2026.6.0.

Affected products

• TensorZero TensorZero Gateway < 2026.6.0

Timeline

• 2026-06-04: disclosed: Initial report by geo-chen
• 2026-07-15: advisory: GitHub Advisory published
• 2026-06-04: patched: Fix included in version 2026.6.0

References

• https://api.github.com/users/geo-chen
• https://github.com/geo-chen
• https://api.github.com/users/geo-chen/gists%7B/gist_id%7D
• https://api.github.com/users/geo-chen/repos
• https://avatars.githubusercontent.com/u/2404584?v=4
• https://api.github.com/users/geo-chen/events%7B/privacy%7D